Hamza Khaled

**Name of the Vulnerable Software and Affected Versions** Nexus Repository 3 (affected versions not specified) **Description** Insufficient sandboxing of JEXL (Java Expression Language) expressions used in Content Selectors allows an account with the `nexus:selectors:create` permission to construct expressions that read Java object properties not intended for exposure. This leads to the disclosure of internal JVM (Java Virtual Machine) class metadata, including class and classloader names. This issue does not allow for method invocation, object construction, or arbitrary code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.